However, according to the ECJ, under EU law such online traffic data should only be retained when operations are carried out in a targeted manner, and in the course of fighting "serious crime".

The UK government says it is assessing the potential impact of the ruling.

"We are disappointed with the judgment from the European Court of Justice and will be considering its potential implications," said a UK Home Office spokesperson.

The ECJ ruling stems, in part, from a challenge to the UK government's Data Retention and Investigatory Powers Act (DRIPA) 2014, which will be replaced by the IPA from the end of December. In July, the UK High Court ruled against DRIPA, triggering an appeal by the government. It was judges at the UK Court of Appeal who then referred the DRIPA case to the ECJ, to clarify EU law on surveillance, and who will now finish considering the case.

Privacy International, one of several pressure group that supported the legal challenge, greeted the decision.

"Today's judgment is a major blow against mass surveillance and an important day for privacy," said Camilla Graham Wood, legal officer with Privacy International.

"It makes clear that blanket and indiscriminate retention of our digital histories - who we interact with, when and how and where - can be a very intrusive form of surveillance that needs strict safeguards against abuse and mission creep. Unfortunately, those safeguards are not present in the Investigatory Powers Act, which is why it's a Snoopers' Charter."

In a summary of its judgement against indiscriminate data collection, the ECJ said "the retained data, taken as a whole, is liable to allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained".

Even where targeted retention of data takes place; the categories of data to be retained, the means of communication affected, the persons concerned and the retention period, should be limited to "what is strictly necessary", the court found.

"Some of the EU Court of Justice's requirements may be addressed relatively easily by changes to the IP Act, but others may cause the UK government serious difficulties," said Graham Smith, partner at international law firm Bird & Bird LLP.

In particular he highlighted "serious disagreements are likely over where the boundary lies between targeted and general data retention".

The UK's IPA is also at odds with the ECJ stipulation that data should only be retained in the fight against "serious crime", he said. Smith also highlighted how the IPA fell short of ECJ requirements for controlling access to data and the need to store data within the EU.

Jim Killock, executive director of the Open Rights Group, which also supported the legal challenge against DRIPA, said: "The CJEU has sent a clear message to the UK government: blanket surveillance of our communications is intrusive and unacceptable in a democracy.

"The government knew this judgment was coming but Theresa May was determined to push through her snoopers' charter regardless. The government must act quickly to re-write the IPA or be prepared to go to court again."

The case against DRIPA was brought by Labor deputy leader Tom Watson and UK Brexit secretary David Davis, who withdrew his support for the case upon taking up his ministerial post.

According to a Privacy International spokesperson, the ruling's potential impact on UK surveillance legislation is complicated by the country's recent vote to leave the European Union, which will eventually result in the UK no longer falling under EU jurisdiction.

However, the ECJ's ruling may still have a bearing on UK law after Britain leaves the EU, according to Bird & Bird's Smith.

"Should the UK become a data protection 3rd country -- like the USA -- post-Brexit, then it may seek an 'adequacy' decision from the European Commission that the UK's protections for personal data are essentially equivalent to those in the EU, so as to enable personal data to be transferred from the EU to the UK," he said.

Thank You

By registering you become a member of the CBS Interactive family of sites and you have read and agree to the Terms of Use, Privacy Policy and Video Services Policy. You agree to receive updates, alerts and promotions from CBS and that CBS may share information about you with our marketing partners so that they may contact you by email or otherwise about their products or services.
You will also receive a complimentary subscription to the ZDNet's Tech Update Today and ZDNet Announcement newsletters. You may unsubscribe from these newsletters at any time.